Support authenticated Hugging Face model and component downloads

2026-09-29 11:47:50 +02:00
parent dad67acad8
commit 7f38286f72
13 changed files with 151 additions and 21 deletions
@@ -97,6 +97,15 @@ class AccessAPITests(unittest.TestCase):
        code,_,headers=self.request('/api/v1/login',{'password':password})
        self.assertEqual(code,200)
        return headers['Set-Cookie'].split(';')[0]
+    def test_hub_credentials_are_session_only_and_never_returned(self):
+        cookie=self.setup_login();path='/api/v1/huggingface';secret='hf_'+'a'*30
+        for value in ({}, {'token':self.token}):
+            self.assertEqual(self.request(path,**value)[0],401)
+            self.assertEqual(self.request(path,{'token':secret},**value)[0],401)
+        code,body,_=self.request(path,{'token':secret},cookie=cookie)
+        self.assertEqual((code,body),(200,{'configured':True}))
+        self.assertEqual(self.request(path,cookie=cookie)[1],{'configured':True})
+        self.assertEqual(self.request(path,{'token':None},cookie=cookie)[1],{'configured':False})
    def test_first_run_and_setup_guard(self):
        self.assertEqual(self.request('/api/v1/status')[0],401)
        self.assertFalse(self.request('/api/v1/auth/status')[1]['initialized'])